# CVE-2026-75850: ArcadeDB authentication bypass in batch/time-series HTTP handlers

Source: https://junglewise.ai/threats/cve-2026-75850-arcadedb-authentication-bypass-in-batch-time-series-http-handlers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75850 · Severity: medium · CVSS 4.2 · Published 2026-08-18

ArcadeDB is a multi-model database used to store and query structured data. The batch and time-series HTTP endpoints fail to properly authenticate user access restrictions, allowing a limited user to read and write data types they should not have permission to access. This only affects deployments using fine-grained per-type access controls; simpler database-level access control configurations are not impacted.

Technologies: [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb). Vendors: [ArcadeData](https://junglewise.ai/threats/vendors/arcadedata).

## Quick answers

**Is CVE-2026-75850 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75850 being exploited in the wild.

**How severe is CVE-2026-75850?** Medium severity, with a CVSS score of 4.2, published 18 August 2026.

**Which products and versions are affected?** ArcadeData ArcadeDB before 26.8.1.

**Is there a fix for CVE-2026-75850?** A patch was published on 2026-08-18: Patch available in ArcadeDB 26.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75850 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75850?** Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization enforcement (CWE-862) in ArcadeDB's batch and time-series HTTP request handlers. The root cause is that while checkAuthorizationOnDatabase validates coarse database-level access, it does not bind the authenticated principal (setCurrentUser) on the worker thread. As a result, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) cannot execute and returns early when the bound user is null, allowing per-type authorization checks to be bypassed. An authenticated attacker with database access but restricted per-type permissions can submit requests to /api/v1/batch or time-series endpoints to read from or write to types they are not authorized to access. The vulnerability requires low privileges (valid database user) and high attack complexity (knowledge of type names and API structure) but has no network complexity barriers. Patches are available in ArcadeDB 26.8.1 and later.

## Affected products

- ArcadeData ArcadeDB before 26.8.1

## Timeline

- 2026-08-04: disclosed: GitHub security advisory GHSA-c23x-pqcj-7hfm published
- 2026-08-18: advisory: CVE-2026-75850 published
- 2026-08-18: patched: Patch available in ArcadeDB 26.8.1

## References

- [https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-c23x-pqcj-7hfm](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-c23x-pqcj-7hfm)
- [https://www.vulncheck.com/advisories/arcadedb-before-per-type-acl-bypass-via-batch-handlers](https://www.vulncheck.com/advisories/arcadedb-before-per-type-acl-bypass-via-batch-handlers)

## Related threats

- [ArcadeDB improper authorization in wire-protocol connections](https://junglewise.ai/threats/cve-2026-119577-arcadedb-before-26-10-2-contains-an-improper-authorization)
- [ArcadeDB authorization bypass in GraphQL schema endpoint](https://junglewise.ai/threats/cve-2026-119576-arcadedb-from-21-12-1-before-26-10-2-contains-an-authorization)
- [ArcadeDB server-side request forgery in LOAD CSV](https://junglewise.ai/threats/cve-2026-119575-arcadedb-from-26-8-1-before-26-10-2-contains-a-server-side)
- [ArcadeDB remote code execution in Gremlin Groovy engine](https://junglewise.ai/threats/cve-2026-114059-arcadedb-before-26-10-1-contains-a-remote-code-execution)
- [ArcadeDB Bolt protocol missing authorization](https://junglewise.ai/threats/cve-2026-114058-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing)